Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,156 detections
Filters
Last updated
All Time
Detection languages
2,302
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,877
5,156
4,865
Platforms
2,859
2,017
816
524
213
Products / Services
1,337
1,144
831
576
366
MITRE Techniques
1,823
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
OysterLoader uses a Windows scheduled task to keep itself running. It creates a task with a name that looks like a normal security or updater tool, so it blends in. The task runs repeatedly in the background, helping the malware come back even after a restart and making it harder to notice or remove.
This rule set detects network communication associated with macOS infostealers, including C2 infrastructure, SHub stealer heartbeat and exfiltration, and ClickFix staging and landing pages. It identifies specific hostnames and URI paths used by these malicious campaigns.
Detects the legitimate Windows utility 'attrib.exe' initiating outbound network connections to common SMTP ports. This behavior is highly anomalous as attrib.exe is used to modify file attributes and should not be making network connections. The Mispadu banking trojan is known to inject its code into attrib.exe and use it to self-propagate by sending phishing emails.
This rule detects activity related to the Chrysalis Backdoor, which is associated with the Lotus Blossom threat group. It identifies malicious activity through three main components: 1. File and process events matching a list of known malicious SHA256 hashes. 2. Network connections to known malicious IP addresses or domains. 3. Suspicious execution of 'svchost.exe' from non-standard Windows directories with specific command-line arguments, indicating potential masquerading or malicious execution.
Detects the execution of S3 Browser or Office installation executables, followed by network traffic from the same host to known cloud storage or file-sharing sites within a short time window. This behavior aligns with Muddled Libra's method of staging and exfiltrating sensitive data, such as PST files, to attacker-controlled cloud buckets.
ET TROJAN Microsoft ClickFix IOC IP
This rule detects the use of unauthorized Remote Monitoring and Management (RMM) tools by identifying network connections to RMM-related URLs that have not been observed in a baseline period (last 7 days) but are observed in the last hour. It specifically filters out connections to approved RMM domains and known initiating processes (like web browsers) to reduce false positives. The rule leverages an external list of RMM domains to identify suspicious activity.
This rule correlates multiple indicators of compromise (IOCs) across file, network, and process events to detect potential advanced persistent threats (APTs) or sophisticated malware. It looks for specific file paths associated with tools like Lightshot, ScreenConnect, or suspicious VS Code extensions, combined with network connections to known malicious domains/IPs or unusual ports, and the execution of suspicious processes like 'Code.exe' outside of its legitimate VS Code path or 'ScreenConnect' related executables. A high threat score is assigned if multiple types of these indicators are observed on the same device and account within a 30-day window.
Detects the execution of a Python interpreter that has been renamed to a common system process name, such as 'svchost.exe'. This is a known TTP used by malware like PXA Stealer to evade detection and blend in with normal system activity. The rule also attempts to correlate this activity with network connections to identify potential C2 communication.
This rule detects network connections to known Remote Monitoring and Management (RMM) tool domains initiated by `cmd.exe` or `powershell.exe`. This behavior can indicate the unauthorized use of RMM tools by an adversary to gain remote access and control over a compromised system. The rule specifically looks for successful network connections where the remote URL matches a URI from a curated list of RMM domains, and the initiating process is either `cmd.exe` or `powershell.exe`, excluding a specific bypass command line.
Detects the SolarWinds Web Help Desk service process (java.exe) launching shell or installer processes to download payloads from suspicious domains. This behavior is consistent with the exploitation of CVE-2025-26399 as reported by Huntress.
This rule detects suspicious outbound network connections to Cloudflare Workers domains, indicative of potential command and control (C2) activity. It identifies connections to known malicious Cloudflare Workers domains or IPs, as well as generic Cloudflare Workers domains (.workers.dev) when initiated by suspicious processes like `WsusService.exe`, `curl.exe`, `certutil.exe`, `bitsadmin.exe`, `Velociraptor.exe`, or `msiexec.exe`. The rule prioritizes detection based on specific indicators like known malicious workers or C2 IPs, and flags activity from processes commonly abused for C2 or payload delivery. It also provides severity scoring and investigation steps based on the identified threat type.
This rule detects instances where users click on URLs from emails that impersonate 'DocMagic'. It specifically looks for emails with 'docmagic' in the sender display name or address, extracts URLs from these emails, and then identifies if any of these URLs were subsequently clicked by users. This indicates a potential successful phishing attempt related to the DocMagic impersonation campaign.
Detects the execution of 'finger.exe' or 'ct.exe' with command-line arguments indicating an attempt to start 'cmd.exe', correlated with network connections to a known malicious IP address (69.67.173.30). This behavior is indicative of LOLBIN (Living Off the Land Binaries and Scripts) abuse for command and control communication.
This detection identifies potential abuse of the Windows Package Manager (winget.exe) for malicious activities, including arbitrary command execution, execution from temporary directories, suspicious network egress, and installation of unsigned binaries from non-admin accounts.
This rule detects potential phishing activity by identifying inbound emails from specific sender addresses that were not blocked by Microsoft Defender for Office (MDO), followed by network connections to a known malicious infrastructure associated with 'Tycoon2FA'. The rule first looks for unblocked emails from 'donotreply@docmagic.com' and 'noreply@frigoarrobba.com.br'. If such emails are found, it then checks for network connections to 'listener.facraivo.sa.com' within a 7-day window, indicating a potential compromise or user interaction with the phishing attempt.
Detects browser processes making direct network connections to known Large Language Model (LLM) API endpoints. This activity is unusual when originating from general user web browsing, as it may indicate a malicious website is using an LLM to dynamically generate and fetch malicious code (e.g., JavaScript for a phishing page) at runtime.
Detects network connections to the Microsoft Graph API (graph.microsoft.com) from processes that are not common Microsoft Office applications. Threat actors, such as those behind the FINALDRAFT malware, have been observed using the Graph API for covert command and control (C2) communications, often by manipulating email drafts to send and receive commands. This allows them to blend their traffic with legitimate enterprise activity.
Detects a browser visiting a URL with phishing-related keywords, followed by a direct network connection to a known Large Language Model (LLM) API endpoint from the same device within a short time window. This correlated behavior is a strong indicator of the "runtime assembly" attack pattern, where a malicious page dynamically generates a phishing payload by calling an LLM service.
Detects the use of the Windows 'finger' utility, often renamed to 'ct.exe', to download and pipe remote commands to cmd.exe. This is a key Living Off The Land Binary (LoLBin) technique used in the CrashFix campaign. The detection specifically looks for 'ct.exe' in the command line, the unique 'confirm@' argument indicating a C2 address, and the piping of output to 'cmd' often launched via 'start'.
This rule detects file and network indicators of compromise (IOCs) associated with the fake 'ClawdBot Agent' VS Code extension malware campaign. It looks for known malicious file hashes and network connections to C2 infrastructure, including specific C2 checks for ScreenConnect relay on port 8041.
Page 194 of 246